NEW: WhatsApp says it has notified 90 victims, including journalists and members of civil society, that they were targeted with spyware made by Paragon. The company said the technique used in the campaign, which relied on malicious PDFs sent via chat groups, has now been fixed. This is the first time that Paragon is linked to alleged abuse of its products.
With iOS 18.3, Apple is switching Apple Intelligence on by default (for newer devices). Given how faulty it is, and maybe for other concerns (environment, ethical), you may want to switch it off. Here's how to do it:
NEW: Facebook awarded a researcher $100,000 for finding a bug in an ad platform that gave access to FB's internal infrastructure. Ben Sadeghipour told TechCrunch that online advertising platforms make for juicy targets because, “there's so much that happens in the background of making these 'ads' — whether they are video, text or images."  "But at the core of it all it's a bunch of data being processed on the server-side and it opens up the door for a ton of vulnerabilities,” he said.
NEW: Cybersecurity experts, who work with human rights defenders and journalists, agree that Apple is doing the right thing by sending notifications to victims of mercenary spyware — and at the same time refusing to forensically analyze the devices. “These notifications have been a game changer for spyware accountability research," said John Scott-Railton, a senior researcher at the Citizen Lab, who has been investigating government spyware for more than a decade.
NEW: Amnesty International has documented two cases where Serbian authorities used Cellebrite to unlock the phones of a journalist and an activist. And then they installed spyware on the devices. In a way, this is a return to the old days of government spyware, where remote attacks were rare and impractical, and cops needed to get their hands on target's computers.
NEW: Ukraine’s Computer Emergency Response Team (CERT-UA) says Russian government hackers are targeting the country's defense sector with phishing emails. The phishing emails were designed to look like they were invitations to a real conference.
NEW: The U.S. government has announced charges against five alleged hackers who targeted several companies stealing millions of dollars in crypto, and corporate data. DOJ says the hackers are part of the infamous Scattered Spider cybercrime group, who "perpetrated a sophisticated scheme to steal intellectual property and proprietary information worth tens of millions of dollars and steal personal information belonging to hundreds of thousands of individuals.”
NEW: WhatsApp forced a judge to release previously non-public court documents, which include a ton of details on how NSO's spyware works. The documents show how NSO targeted WhatsApp, the number of customers the company had to cut off because of abuse, and more. Here are the biggest revelations.
NEW: A Spanish lawyer allegedly hacked with NSO's spyware is naming the founders of the company in his lawsuit against NSO. This appears to be the first time a victim of spyware is going directly after the people behind the surveillance tech makers. “[Lawyer] Van Den Eynde was spied on to gain access to his clients and the legal strategy of the cases he was handling, creating a chain effect of rights violations: by spying on him, all his contacts were indirectly spied on,” a nonprofit working on the wrote in a press release. “What is more, this surveillance is carried out without any criminal proceedings being brought against him and therefore without any judicial control.”
Does anyone track every lawsuit against NSO around the world by any chance?